io.github.chrischall/zola-mcp
NPM · ZOLA-MCP
Zola wedding planning for Claude — vendors, budget, guests, seating, registry, and RSVPs
Available components
Last scanned (4 hours ago)
Scores higher than 98% of npm servers
Category Productivity and Notes
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 0 of 9 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to chrischall/zola-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability79
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 7736 tokens (~100/item across 77 items; 77 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage88
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 65% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 8 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 77 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +11
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 1.00 ▲ functional
- 4 Nov 26 −11
- Known CVEs: pass → unverified ▼ security
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Dependency health: 1.00 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Package version: 2.1.12 → 2.2.1 functional
- Package version: 2.1.12 → 2.2.0 functional
- 3 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 2 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 2.1.10 → 2.1.12 functional
- 25 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
- 24 Oct 26 0
- Security disclosure: fail → unverified ▼ functional
- 17 Oct 26 +2
- Stability: 0.90 → pass security
- 16 Oct 26 −2
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Stability: pass → 0.90 functional
- Package version: 2.1.10 → 2.1.11 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/zola-mcp@2.2.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | chrischall/zola-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/chrischall/zola-mcp/.github/workflows/release-please.yml@refs/heads/main |
| Rekor log index | 3691825500 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:aaf1b51ce8d93004a567da18357e6a26abcaad7e87ae819ab2f8d0a0dd564d6770f7c9cf0e9ce4ccac2fca852ff0c6eaec4235f527ed530f8b87bf462 |
Background: How many MCP packages publish verified provenance →
Dependencies 9 packages
| Packages resolved | 9 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
reorder_pages ~43
Reorder pages in the website navigation. Pass the complete ordered list of page IDs.
| Name | Type | Req | Description |
|---|---|---|---|
| page_ids | array | yes | Full ordered list of page IDs in desired nav order |
No output schema declared.
No examples provided.
search_card_catalog ~89
Search the invitation design catalog. Faceted search returning suites matching the requested card type.
| Name | Type | Req | Description |
|---|---|---|---|
| card_type | string | – | Lead card type: INVITATION (default), SAVE_THE_DATE, WEDDING_SHOWER_INVITATION, REHEARSAL_DINNER_INVITATION, THANK_YOU_CARD, etc. |
| limit | number | – | Max suites to return. Default: 50. |
No output schema declared.
No examples provided.
search_registry_products ~84
Browse Zola products in a category, scoped to your registry. Category IDs are Zola constants (e.g. 544 = Kitchen) — exposed via GET /v3/categories in the iOS app.
| Name | Type | Req | Description |
|---|---|---|---|
| category_id | number | yes | Zola product category ID |
| limit | number | – | Default 50 |
| offset | number | – | Default 0 |
No output schema declared.
No examples provided.
search_storefronts ~149
Search Zola vendor marketplace by category and location (1=Venues, 2=Photographers, 3=Florists, 7=Planners, 9=Bands/DJs)
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | yes | City name (e.g. Charlotte) |
| limit | number | – | Results per page (default 24) |
| offset | number | – | Pagination offset (default 0) |
| state_province | string | yes | State abbreviation (e.g. NC) |
| taxonomy_node_id | number | yes | Vendor category ID (1=Venues, 2=Photographers, 3=Florists, 7=Planners, 9=Bands/DJs) |
No output schema declared.
No examples provided.
search_themes ~53
Browse the catalog of available wedding-website themes
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Default 50 |
| offset | number | – | Default 0 |
| theme_layout_types | array | – | Default ["MULTI_PAGE"] |
No output schema declared.
No examples provided.
search_vendors ~74
Search for vendors by name (typeahead) within a vendor category
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | Vendor name to search for |
| taxonomy_key | string | – | Vendor category key (e.g. wedding-venues, wedding-photographers, wedding-planners, wedding-bands-djs). Default: wedding-venues |
No output schema declared.
No examples provided.
set_card_project_guests ~81
Enable / disable guest groups for an invitation project and optionally override font sizes for printed names and addresses. Pass the full list of guest groups you want recorded.
| Name | Type | Req | Description |
|---|---|---|---|
| guest_groups | array | yes | Full list of guest groups to record. Omitted groups are not affected by this call. |
| project_uuid | string | yes | Project UUID from list_card_projects |
No output schema declared.
No examples provided.
set_card_project_qrcode ~169
Place (or update) a QR code on a specific page of an invitation project. The page UUID comes from get_card_project (look under the customization's pages array).
| Name | Type | Req | Description |
|---|---|---|---|
| color | string | – | Hex color (no #). Default: 000000 |
| dimension | string | – | SMALL | MEDIUM (default) | LARGE |
| enabled | boolean | – | Whether to enable the QR code. Default: true. |
| page_uuid | string | yes | Page UUID of the customization to put the QR on |
| project_uuid | string | yes | Project UUID from list_card_projects |
| url | string | yes | URL the QR code will resolve to |
| url_type | string | – | CUSTOM (default) | WEDDING_WEBSITE | WEDDING_WEBSITE_RSVP |
No output schema declared.
No examples provided.
set_event_guests ~288
Set which guest groups are invited to an event (bulk). For each group, invited:true ensures every guest in the group is invited to the event; invited:false removes the invitation — and with it any RSVP the guest recorded for this event (response, meal choice), which cannot be restored. Other events’ invitations are preserved. Idempotent. Use this to assign guests to events in bulk (e.g. by tier/affiliation/location). A call that uninvites anyone asks the user to confirm first (a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds — see MCP_CONFIRM_MODE). A call that only invites runs immediately.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmToken | string | – | ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has se… |
| event_id | number | yes | Event entity ID from list_events (event_entity_id) |
| guest_groups | array | yes | Guest groups to set for this event. Only the listed groups are affected; list each guest_group_id once. |
No output schema declared.
No examples provided.
set_page_hidden ~61
Show or hide a page on the wedding website (e.g., hide the RSVP page until invites go out)
| Name | Type | Req | Description |
|---|---|---|---|
| hidden | boolean | yes | true to hide the page, false to show it |
| page_id | number | yes | Page ID from list_pages |
No output schema declared.
No examples provided.
swap_card_project_variation ~77
Swap one or more customizations on a project to different variations (e.g. switch paper type, color, or size). Pass a map of customization UUID → new variation UUID.
| Name | Type | Req | Description |
|---|---|---|---|
| customizations | object | yes | { customization_uuid: new_variation_uuid } |
| project_uuid | string | yes | Project UUID from list_card_projects |
No output schema declared.
No examples provided.
track_rsvps ~25
Get RSVP tracking summary per event (attending, declined, not responded)
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
update_budget_item ~60
Update a budget item's actual cost and/or note by UUID
| Name | Type | Req | Description |
|---|---|---|---|
| actual_cost_cents | number | – | Actual cost in cents |
| note | string | – | Note for the budget item |
| uuid | string | yes | Budget item UUID from get_budget |
No output schema declared.
No examples provided.
update_current_theme ~60
Switch the wedding website to a different theme template
| Name | Type | Req | Description |
|---|---|---|---|
| theme_key | string | yes | Theme key from search_themes (e.g., "galata", "blake-cranberry") |
| theme_layout_type | string | – | Default MULTI_PAGE |
No output schema declared.
No examples provided.
update_event ~325
Update a wedding event (name, time, venue, location, dress code, RSVP settings). Guests see these details on the website. Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).
| Name | Type | Req | Description |
|---|---|---|---|
| address1 | string | – | Street address |
| attire | string | – | Dress code |
| city | string | – | – |
| collect_rsvps | boolean | – | Whether to collect RSVPs for this event |
| confirmToken | string | – | ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has se… |
| country_code | string | – | Default: US |
| end_at | string | – | End time ISO 8601 |
| event_id | number | yes | Event entity ID from list_events |
| name | string | – | Event name |
| note | string | – | Event notes/description |
| postal_code | string | – | – |
| start_at | string | – | Start time ISO 8601 (e.g. 2026-10-17T18:30:00Z) |
| state_province | string | – | – |
| venue_name | string | – | Venue name |
No output schema declared.
No examples provided.
update_faq ~68
Update an existing FAQ — all three fields (question, answer, display_order) must be supplied
| Name | Type | Req | Description |
|---|---|---|---|
| answer | string | yes | – |
| display_order | number | yes | – |
| faq_entity_id | number | yes | FAQ entity ID from list_faqs |
| question | string | yes | – |
No output schema declared.
No examples provided.
update_guest_address ~83
Update a guest group's mailing address
| Name | Type | Req | Description |
|---|---|---|---|
| address1 | string | – | – |
| address2 | string | – | – |
| city | string | – | – |
| country_code | string | – | Default: US |
| guest_group_id | number | yes | Guest group ID from list_guests |
| postal_code | string | – | – |
| state_province | string | – | – |
No output schema declared.
No examples provided.
update_home_section ~74
Update a home page story section — all fields must be supplied
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | – |
| display_order | number | yes | – |
| hidden | boolean | yes | – |
| homepage_entity_id | number | yes | Home section ID from list_home_sections |
| subtitle | string | yes | – |
| title | string | yes | – |
No output schema declared.
No examples provided.
update_page ~127
Update page-level metadata (title, intro copy, nav title, visibility, layout customization)
| Name | Type | Req | Description |
|---|---|---|---|
| customization | – | – | Layout customization object (see list_pages for shape) |
| description | string | – | Page description |
| hidden | boolean | – | Hide the page from the public site |
| intro_copy | string | – | Introductory paragraph on the page |
| menu_title | string | – | Title shown in mobile menu |
| nav_title | string | – | Title shown in nav bar |
| page_id | number | yes | Page ID from list_pages |
| title | string | – | On-page title |
No output schema declared.
No examples provided.
update_poi ~148
Update a point-of-interest. Provide only the fields you want to change.
| Name | Type | Req | Description |
|---|---|---|---|
| address1 | string | – | – |
| address2 | string | – | – |
| city | string | – | – |
| contact_phone | string | – | – |
| country_code | string | – | – |
| description | string | – | – |
| display_order | number | – | – |
| google_place_id | string | – | – |
| latitude | string | – | – |
| longitude | string | – | – |
| poi_entity_id | number | yes | POI ID from list_pois |
| postal_code | string | – | – |
| state_province | string | – | – |
| title | string | – | – |
| url | string | – | – |
No output schema declared.
No examples provided.
update_registry_item ~96
Update an existing registry item — all fields must be supplied (it's a full replace)
| Name | Type | Req | Description |
|---|---|---|---|
| collection_id | string | yes | Collection the item belongs to |
| collection_item_id | string | yes | Item ID from get_registry |
| group_gift | boolean | yes | – |
| marked_fulfilled | boolean | yes | – |
| most_wanted | boolean | yes | – |
| personal_note | string | yes | – |
| quantity | number | yes | – |
No output schema declared.
No examples provided.
update_travel_item ~185
Update a travel item. Provide only the fields you want to change.
| Name | Type | Req | Description |
|---|---|---|---|
| address1 | string | – | – |
| address2 | string | – | – |
| city | string | – | – |
| code | string | – | – |
| contact_number | string | – | – |
| country_code | string | – | – |
| display_order | number | – | – |
| email_address | string | – | – |
| google_place_id | string | – | – |
| latitude | string | – | – |
| longitude | string | – | – |
| name | string | – | – |
| note | string | – | – |
| postal_code | string | – | – |
| source | string | – | – |
| state_province | string | – | – |
| timezone | string | – | – |
| travel_entity_id | number | yes | Travel entity ID from list_travel_items |
| type | string | – | – |
| url | string | – | – |
No output schema declared.
No examples provided.
update_vendor ~104
Update a booked vendor's details
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | – |
| string | – | – | |
| event_date | string | – | ISO 8601 date (YYYY-MM-DD) or timestamp; an unparseable value is rejected |
| name | string | – | – |
| phone | string | – | Vendor phone |
| price_cents | number | – | – |
| state_province | string | – | – |
| uuid | string | yes | Vendor UUID from list_vendors |
No output schema declared.
No examples provided.
update_website_customization ~281
Update website colors and fonts. Provide only what changes. Colors are 6-char hex without #. Note: when header_font_family_id changes, the wrapper auto-fetches current state and re-sends all active colors to defend against a Zola partial-update wipe bug. body_font_family_id is restricted to [68, 198]. header_color and nav_font_color exist on Zola's web-api endpoint but are NOT writable via the mobile-api this MCP uses — change them in the Zola web UI for now.
| Name | Type | Req | Description |
|---|---|---|---|
| accent_color | string | – | 6-char hex (no #) |
| background_color | string | – | – |
| body_font_color | string | – | – |
| body_font_family_id | number | – | Restricted to 68 (Libre Baskerville) or 198 (Circular). Other IDs return a generic API error. |
| header_color | string | – | Writable only via Zola's web-api (cookie+CSRF), not the mobile-api this MCP uses. Passing this throws. |
| header_font_family_id | number | – | Font family ID — call get_website_customizations to see available font_family_ids |
| nav_font_color | string | – | Writable only via Zola's web-api (cookie+CSRF), not the mobile-api this MCP uses. Passing this throws. |
| navigation_background_color | string | – | – |
No output schema declared.
No examples provided.
update_wedding_settings ~339
Update top-level wedding settings. Provide only the fields you want to change; the rest are preserved. Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | – |
| confirmToken | string | – | ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has se… |
| enable_search_engine | boolean | – | Allow search engines (Google, etc.) to index the site |
| enable_search_zola | boolean | – | Allow Zola search to find the site |
| guest_count | number | – | – |
| hashtag | string | – | e.g. #alexjordan2026 — empty string clears it |
| owner_first_name | string | – | – |
| owner_last_name | string | – | – |
| partner_first_name | string | – | – |
| partner_last_name | string | – | – |
| slug | string | – | URL slug — appears in the public website URL. Changing it breaks every link and QR code already shared or printed with the old URL |
| state_province | string | – | – |
| title | string | – | Wedding title (e.g., "Alex & Jordan") |
| wedding_date | string | – | YYYY-MM-DD |
No output schema declared.
No examples provided.
validate_card_project ~49
Validate an invitation project — reports any text-fit, image, or guest-addressing errors per customization. Use before placing an order.
| Name | Type | Req | Description |
|---|---|---|---|
| project_uuid | string | yes | Project UUID from list_card_projects |
No output schema declared.
No examples provided.
zola_healthcheck Verify credentials and upstream reachability ~104
Resolves the credential the way real tools do, then makes one authenticated request to mobile-api.zola.com. Reports which source supplied the credential, whether mobile-api.zola.com accepted it, the round-trip time, and a plain-English hint distinguishing 'no credential' from 'credential rejected' from 'a mobile-api.zola.com-side problem'. Read-only; never returns the credential itself. Call this when a real tool fails and you want to know which hop broke.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the io.github.chrischall/zola-mcp server?
io.github.chrischall/zola-mcp runs locally as an npm package, launched with npx -y zola-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · zola-mcp
claude mcp add chrischall-zola-mcp -- npx -y zola-mcp
What is the io.github.chrischall/zola-mcp server?
io.github.chrischall/zola-mcp is listed in the public MCP registry as io.github.chrischall/zola-mcp. Zola wedding planning for Claude, vendors, budget, guests, seating, registry, and RSVPs. This page covers its npm package (zola-mcp).
Is the io.github.chrischall/zola-mcp server safe to use?
io.github.chrischall/zola-mcp scores 95 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.chrischall/zola-mcp server expose?
io.github.chrischall/zola-mcp exposes 77 tools: list_vendors, search_vendors, add_vendor, update_vendor, remove_vendor, and 72 more. Their descriptions and schemas cost roughly 7,736 tokens of context every time the server is loaded.
Is the io.github.chrischall/zola-mcp server still maintained?
io.github.chrischall/zola-mcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.chrischall/zola-mcp server under?
io.github.chrischall/zola-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.